Last updated 18 Aug 2026
This is a working draft, not a published policy. It hasn't been reviewed by a lawyer yet - edit it here as that review happens, but don't rely on it or link it publicly until it has been.
From everyone with an account: name, phone number, email address, and password.
From customers, when searching for help: your device's location, used only to find and rank nearby providers.
From providers: national ID number and a photo of your ID document (for verification), a profile photo, your business name and bio, and your location while marked available - shared with customers who book you so they can see you're on the way.
From everyone using a booking: the messages sent in that booking's chat, and a push notification token if you allow notifications.
We don't collect payment card details or M-Pesa PINs - those go directly to Safaricom, never through Kwamua's servers.
We don't use your data for advertising, and we don't sell it to anyone.
The other party in a booking sees your name and, once you choose to unlock contact for that booking, your phone number - Kwamua only reveals phone numbers after either side pays the contact-unlock fee for that specific booking, never automatically the moment a booking is made.
Safaricom receives what's needed to process an M-Pesa payment (your phone number and the amount) when you pay a fee. Expo and Google receive a device token to deliver push notifications. Neither receives your booking content or chat messages.
We share data with Kenyan authorities only when legally required to.
We keep account and booking data for as long as your account is active, plus a reasonable period after account deletion for dispute resolution, fraud prevention, and legal record-keeping - after which it's deleted or anonymized.
Under Kenya's Data Protection Act, 2019, you can ask to see what data we hold about you, ask us to correct it, ask us to delete it, and object to how it's being used. To exercise any of these, contact us using the details below. You can also complain directly to the Office of the Data Protection Commissioner (ODPC) if you believe we've mishandled your data.
Data moves over encrypted connections (HTTPS) between the app and our servers, and account sessions use token-based authentication that can be revoked. No system is perfectly secure, and we can't guarantee absolute protection against every possible attack.
Kwamua isn't intended for anyone under 18. We don't knowingly collect data from minors.
If this policy changes in a material way, we'll notify users in the app before the change takes effect.
Adcoar Ltd, operating Kwamua. Email: [email protected] (placeholder - set a real monitored address before publishing).